Timeline for Can I slow down a brute force attack by encoding password input data?

8 events

when toggle format	what		by	license	comment
Apr 24, 2017 at 0:53	vote	accept	The-Vinh VO
Apr 24, 2017 at 0:28	history	edited	Arminius	CC BY-SA 3.0	added 694 characters in body
Apr 21, 2017 at 23:21	comment	added	Arminius		@JohnWu You're right, I simplified that too much. Having the server do the same work obviously doesn't make sense. That's why one common proof-of-work scheme is to partially invert a hash - which is hard to do but easy to verify. E.g.: Find a SHA256 hash ending with `...deadbeef123`. I'll clarify that in my answer.
Apr 21, 2017 at 23:10	comment	added	John Wu		+1 for "proof of work"... I hadn't heard that term. The problem with Julien's solution is that it requires the server to do just as much work as the client. Seems like it would be better for the server just to pick a nonce with N bits entropy + M bits salt and compute its hash, then give the hash and salt to the client and ask it to return the original nonce. That would be proof that it had executed (on average) 2^N/2 hash operations, a much bigger hurdle than is imposed on the server, which only did one.
Apr 21, 2017 at 19:57	history	edited	Arminius	CC BY-SA 3.0	added 78 characters in body
Apr 21, 2017 at 19:42	history	edited	Arminius	CC BY-SA 3.0	added 260 characters in body
Apr 21, 2017 at 19:36	history	edited	Arminius	CC BY-SA 3.0	added 260 characters in body
Apr 21, 2017 at 19:27	history	answered	Arminius	CC BY-SA 3.0